Add IDA plugins to default configuration

[Ana06]

Details

At the moment, the only IDA plugin we have in the default configuration is capa explorer. This is nice as when you install IDA Pro, it detects the Python3 installation and the capa explorer plugin is available without any extra steps. We have recently added some more IDA plugins to VM-Packages that we could add to the FLARE-VM default configuration too:

1. https://github.com/A200K/IDA-Pro-SigMaker
2. https://github.com/danigargu/deREferencing
3. https://github.com/gaasedelen/lighthouse
4. https://github.com/hasherezade/ida_ifl
5. https://github.com/airbus-cert/comida

@mandiant/flare-vm opinions on which ones we should add to the default config?

[thejoelpatrol]

I would like to see these four, especially the shellcode hashes:
https://github.com/mandiant/flare-ida/tree/master/plugins

A big priority for me would also be the MSDN documentation annotator:
https://github.com/mandiant/flare-ida/blob/master/python/flare/annotate_IDB_MSDN.py
That one does rely on a database file which would probably contain copyrighted material so it's a little more complicated. It's also not structured as a plugin, but as a script.

[Ana06]

@thejoelpatrol thanks for the feedback. I was asking in this issue about the already created packages, as we would just need to add them to the config. I have created a new issue in VM-Packages to discuss the addition of flare-ida (so that we keep the discussions separated): mandiant/VM-Packages#1032

[mr-tz]

I vote to add comida.

[Ana06]

Two more candidates that are being currently added:

• ida.plugin.flare.vm Add ida.plugin.flare.vm with shellcode_hashes_search_plugin & apply_callee_type_plugin VM-Packages#1036
• ida.plugin.hashdb.vm Add ida.plugin.hashdb.vm VM-Packages#1037

[Ana06]

I have been testing the plugins and I would like to add:

• ida.plugin.dereferencing.vm
• ida.plugin.flare.vm
• ida.plugin.comida.vm
• ida.plugin.ifl.vm

@mandiant/flare-vm anything against it? any other package you would like to get added?

[mr-tz]

no concerns on my side, thanks